HY-love-sleep commented on issue #7459: URL: https://github.com/apache/shenyu/issues/7459#issuecomment-6095451283
# #7459 — claim comment (draft, not posted) I'd like to take this one. The mechanism is the one behind #6472's sibling case: `rewriteRequestPath()` validates the extracted target as a whole against the path character set `^/[a-zA-Z0-9/_\-]*$`, so a legitimate origin-form target carrying a query string (`/rewritten?new=2`) is rejected -- the `?` is not in that class. The generated body and headers are still applied, so the downstream URI silently stays on the original path. Plan: split the extracted target into path and query, validate the path with the current rule and the query against RFC 3986 query syntax (rejecting malformed percent-encoding so the value stays a legal URI reference), then apply both to the request URI. The existing fail-safe behaviour is kept: if either component is invalid, the whole rewrite is skipped. I have the AI plugin line in progress here -- #7153/#7155 (sensitive word plugin), #7138/#7166 (AI token limiter), #7178 (AI proxy) are merged, and #6095 added the AI response transformer. Happy to be redirected if you would rather see the parsing fix and the routing-context divergence (#7460) handled as one change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
